2ND GLITCH REPORTED IN NET BROWSER : MICROSOFT PREPARING PATCH TO CORRECT BUG.

Byline: Tim Klass Associated Press 

Another security flaw has turned up in Microsoft's Internet Explorer browser which, like one found earlier in the week, could enable a Web site operator to wreak havoc in someone else's computer.

Double-clicking on icons to run programs as in normal Windows operations, the defect would allow the operator to run programs secretly on another computer, send electronic mail under someone else's name, severely damage software stored on a hard drive or wipe out the hard drive altogether.

``It could be the hard drive of any computer out there on the Internet,'' said David Ross, a University of Maryland student who reported the latest defect.

``Scary, isn't it?'' said Dan Kusnetzky, director of the client server environments program at International Data Corp. in Framingham, Mass., after hearing a technical description of the flaw.

The most virulent potential from the bug, identified in Internet Explorer 3.0, is for users running Windows NT 4.0 with Service Pack 1 or 2 who are not protected by firewalls, computer security barriers typically used by large business customers to prevent unauthorized entry through cyberspace.

That makes it a much more narrow problem than the previous glitch, found in Internet Explorer versions 3.0 and 3.01 for the Windows 95 and Windows NT 4.0 operating systems.

Kusnetzky said the maximum number of Windows NT machines from which someone could take advantage of the flaw is 500,000 to 750,000, and the actual number is probably much lower, while the maximum for the earlier problem is more than 48 million machines.

At the same time, NT operators ``are probably more sophisticated users. They are probably running much more network-oriented programs,'' he said. ``They are probably the people who are most likely to be affected by an Internet-oriented problem.''

No customers have reported security breaches from either flaw, said David Fester, product manager for the Internet platforms division at Microsoft Corp.'s world headquarters in Redmond, Wash.

``This (latest flaw) is a really difficult thing to reproduce,'' Fester said. ``For somebody to do this is very difficult.

``At the same time, I don't mean to minimize this in any way. We're moving very rapidly to fix that.''

A software patch to close the newest potential breach should be available for free downloads on the World Wide Web within 48 hours, Fester said.

The patch Microsoft developed to fix the previous problem won't fix the new one, he added.

Ross, a senior majoring in computer science from Randallstown, Md., reported it Thursday to Microsoft and described it on the Web, complete with point-and-click examples for Internet Explorer users with Windows NT.

By clicking on an Internet address known as a universal resource locater, or URL, Internet Explorer calls up a window within the browser. The defect can allow a knowledgeable user to create another window through which the he can run programs on other computers remotely.